Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2009.1203
Firewall Services Module Crafted ICMP Message Vulnerability
20 August 2009
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Firewall Services Module (FWSM)
FWSM for Cisco Catalyst 6500 Series Switches
FWSM for Cisco 7600 Series Routers
Publisher: Cisco Systems
Operating System: Cisco
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2009-0638
Original Bulletin:
http://www.cisco.com/warp/public/707/cisco-sa-20090819-fwsm.shtml
Comment: Cisco suggests users of version 2.x should consider migrating to
version 3.x or 4.x.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Firewall Services Module Crafted ICMP Message
Vulnerability
Advisory ID: cisco-sa-20090819-fwsm
http://www.cisco.com/warp/public/707/cisco-sa-20090819-fwsm.shtml
Revision 1.0
For Public Release 2009 August 19 1600 UTC (GMT)
Summary
=======
A vulnerability exists in the Cisco Firewall Services Module (FWSM) for
the Catalyst 6500 Series Switches and Cisco 7600 Series Routers. The
vulnerability may cause the FWSM to stop forwarding traffic and may be
triggered while processing multiple, crafted ICMP messages.
There are no known instances of intentional exploitation of this
vulnerability. However, Cisco has observed data streams that appear to
trigger this vulnerability unintentionally.
Cisco has released free software updates that address this
vulnerability.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20090819-fwsm.shtml.
Affected Products
=================
Vulnerable Products
- - -------------------
All non-fixed 2.x, 3.x and 4.x versions of the FWSM software are
affected by this vulnerability.
To determine the version of the FWSM software that is running, issue
the "show module" command-line interface (CLI) command from Cisco IOS
Software or Cisco Catalyst Operating System Software to identify what
modules and sub-modules are installed in the system.
The following example shows a system with an FWSM (WS-SVC-FWM-1)
installed in slot 4.
switch#show module
Mod Ports Card Type Model Serial No.
--- ----- -------------------------------------- ----------------- -----------
1 48 SFM-capable 48 port 10/100/1000mb RJ45 WS-X6548-GE-TX SAxxxxxxxxx
4 6 Firewall Module WS-SVC-FWM-1 SAxxxxxxxxx
5 2 Supervisor Engine 720 (Active) WS-SUP720-BASE SAxxxxxxxxx
6 2 Supervisor Engine 720 (Hot) WS-SUP720-BASE SAxxxxxxxxx
After locating the correct slot, issue the "show module <slot number>"
command to identify the software version that is running.
switch#show module 4
Mod Ports Card Type Model Serial No.
--- ----- -------------------------------------- ----------------- -----------
4 6 Firewall Module WS-SVC-FWM-1 SAxxxxxxxxx
Mod MAC addresses Hw Fw Sw Status
--- --------------------------------- ------ ------------ ------------ -------
4 0003.e4xx.xxxx to 0003.e4xx.xxxx 3.0 7.2(1) 3.2(3) Ok
The preceding example shows that the FWSM is running software version
3.2(3) as indicated by the column under "Sw".
Note: Recent versions of Cisco IOS Software will show the software
version of each module in the output from the "show module" command;
therefore, executing the "show module <slot number>" command is not
necessary.
If a Virtual Switching System (VSS) is used to allow two physical Cisco
Catalyst 6500 Series Switches to operate as a single logical virtual
switch, the "show module switch all" command can display the software
version of all FWSMs that belong to switch 1 and switch 2. The output
from this command will be similar to the output from the "show module
<slot number>" but will include module information for the modules in
each switch in the VSS.
Alternatively, version information can be obtained directly from the
FWSM through the "show version" command, as shown in the following
example.
FWSM#show version
FWSM Firewall Version 3.2(3)
Customers who use the Cisco Adaptive Security Device Manager (ASDM) to
manage their devices can find the version of the software displayed in
the table in the login window or in the upper left corner of the ASDM
window. The version notation is similar to the following example.
FWSM Version: 3.2(3)
Products Confirmed Not Vulnerable
- - ---------------------------------
Other Cisco products that offer firewall services, including Cisco IOS
Software, Cisco ASA 5500 Series Adaptive Security Appliances, and Cisco
PIX Security Appliances, are not affected by this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
The Cisco FWSM is a high-speed, integrated firewall module for Catalyst
6500 Series Switches and Cisco 7600 Series Routers. The FWSM offers
firewall services with stateful packet filtering and deep packet
inspection.
A vulnerability exists in the Cisco FWSM Software that may cause
the FWSM to stop forwarding traffic between interfaces, or stop
processing traffic that is directed at the FWSM (management traffic)
after multiple, crafted ICMP messages are processed by the FWSM. Any
traffic that transits or is directed towards the FWSM is affected,
regardless of whether ICMP inspection ("inspect icmp" command under
Class configuration mode) is enabled.
The FWSM stops processing traffic because one of the Network Processors
(NPs) that is used by the FWSM to handle traffic may use all available
execution threads while handling a specific type of crafted ICMP
messages. This behavior limits the execution threads that are available
to handle additional traffic.
Administrators may be able to determine if the FWSM has been affected
by this vulnerability by issuing the "show np 2 stats" command. If this
command produces output showing various counters and their values, as
shown in the example CLI output that follows, the FWSM has not been
affected by the vulnerability. If the command returns a single line that
reads "ERROR: np_logger_query request for FP Stats failed", the FWSM may
have been affected by the vulnerability.
FWSM#show np 2 stats
- - -------------------------------------------------------------------------------
Fast Path 64 bit Global Statistics Counters (NP-2)
- - -------------------------------------------------------------------------------
PKT_MNG: total packets (dot1q) rcvd : 10565937
PKT_MNG: total packets (dot1q) sent : 4969517
PKT_MNG: total packets (dot1q) dropped : 65502
PKT_MNG: TCP packets received : 0
PKT_MNG: UDP packets received : 4963509
PKT_MNG: ICMP packets received : 0
PKT_MNG: ARP packets received : 2
PKT_MNG: other protocol pkts received : 0
PKT_MNG: default (no IP/ARP) dropped : 0
SESS_MNG: sessions created : 18
SESS_MNG: sessions embryonic to active : 0
[...]
An FWSM that stops processing traffic as a result of this vulnerability
will need to be reloaded. Administrators can reload the FWSM from the
supervisor of the Catalyst 6500 Series Switch or the Cisco 7600 Series
Router by issuing the command "hw-module module <slot # for FWSM> reset"
(Cisco IOS Software), or "set module power up| down <module #>" (Cisco
CatOS Software). Note that unless the FWSM software is updated to a
non-vulnerable version, or crafted ICMP messages are blocked (see the
Workarounds section for details), the FWSM can still be subject to
exploitation (intentional or otherwise) after a reload.
If an FWSM that is configured for failover operation encounters this
issue, the active FWSM may not properly fail over to the standby FWSM.
IPv6 (in particular ICMPv6) cannot trigger this vulnerability.
This issue is documented in Cisco Bug ID CSCsz97207 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2009-0638.
Vulnerability Scoring Details
+----------------------------
Cisco has provided scores for the vulnerability in this advisory based
on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in
this Security Advisory is done in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of the
vulnerability in individual networks.
Cisco has provided a FAQ to answer additional questions regarding CVSS
at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* NP 2 threads lock due to processing crafted ICMP message (CSCsz97207)
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability may cause the FWSM to
stop forwarding traffic between interfaces (transit traffic), and stop
processing traffic directed at the FWSM (management traffic). If the
FWSM is configured for failover operation, the active FWSM may not fail
over to the standby FWSM.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the FWSM software table below describes a major FWSM
software train and the earliest possible release within that train that
contains the fix (the "First Fixed Release") and the anticipated date of
availability (if not currently available) in the "First Fixed Release"
column. A device running a release that is earlier than the release in
a specific column (less than the First Fixed Release) is known to be
vulnerable. The release should be upgraded at least to the indicated
release or a later version (greater than or equal to the First Fixed
Release label).
+---------------------------------------+
| Major | First Fixed Release |
| Release | |
|------------+--------------------------|
| 2.x | Vulnerable; migrate to |
| | 3.x or 4.x |
|------------+--------------------------|
| 3.1 | 3.1(16) |
|------------+--------------------------|
| 3.2 | 3.2(13) |
|------------+--------------------------|
| 4.0 | 4.0(6) |
+---------------------------------------+
Fixed FWSM software can be downloaded from the Software Center on
cisco.com by visiting http://www.cisco.com/public/sw-center/index.shtml
and navigating to "Security" > "Cisco Catalyst 6500 Series Firewall
Services Module" > "Firewall Services Module (FWSM) Software".
Workarounds
===========
There are no workarounds for this vulnerability. Access control lists
(ACLs) that are deployed on the FWSM itself to block through-the-device
or to-the-device ICMP messages are not effective to prevent this
vulnerability. However, blocking unnecessary ICMP messages on screening
devices or on devices in the path to the FWSM will prevent the FWSM
from triggering the vulnerability. For example, the following ACL,
when deployed on a Cisco IOS device in front of the FWSM, will prevent
crafted ICMP messages from reaching the FWSM, and thus protect the FWSM
from triggering the vulnerability:
access-list 101 permit icmp any any echo
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any traceroute
access-list 101 permit icmp any any packet-too-big
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any host-unreachable
access-list 101 permit icmp any any unreachable
access-list 101 deny icmp any any
access-list 101 permit ip any any
This sample ACL is allowing certain ICMP messages that are vital for
network troubleshooting and for proper operation of the network. It is
safe to allow any other ICMP messages for which the Cisco IOS Software
"access-list" command has named ICMP type keywords. ACLs like the one
in the preceding example may also be deployed on non-Cisco IOS devices,
such as the Cisco PIX and ASA security appliances, although the ACL
syntax on non-Cisco IOS devices may not support all the named ICMP type
keywords that the Cisco IOS ACL syntax supports. However, on non-Cisco
IOS devices, it is safe to permit all ICMP messages for which there are
named ICMP type keywords in the ACL syntax.
As mentioned in the Details section, if the FWSM has stopped processing
traffic due to this vulnerability, the FWSM will require a reload.
Administrators can reload the FWSM by logging in to the supervisor
of the Catalyst 6500 Series Switch or the Cisco 7600 Series router
and issuing the "hw-module module <slot # for FWSM> reset" (Cisco
IOS Software), or "set module power up|down <module #>" (Cisco CatOS
Software) commands.
Additional mitigations that can be deployed on Cisco devices within the
network are available in the Cisco Applied Mitigation Bulletin companion
document for this advisory, which is available at the following link:
http://www.cisco.com/warp/public/707/cisco-amb-20090819-fwsm.shtml.
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt@cisco.com or security-alert@cisco.com for software
upgrades.
Customers with Service Contracts
- - --------------------------------
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's worldwide
website at http://www.cisco.com.
Customers using Third Party Support Organizations
- - -------------------------------------------------
Customers whose Cisco products are provided or maintained through prior
or existing agreements with third-party support organizations, such
as Cisco Partners, authorized resellers, or service providers should
contact that support organization for guidance and assistance with the
appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or fix
is the most appropriate for use in the intended network before it is
deployed.
Customers without Service Contracts
- - -----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco service
contract, and customers who purchase through third-party vendors but are
unsuccessful in obtaining fixed software through their point of sale
should acquire upgrades by contacting the Cisco Technical Assistance
Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to a
free upgrade. Free upgrades for non-contract customers must be requested
through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory, but Cisco is aware
of customers that have encountered this vulnerability during normal
network operation.
This vulnerability was discovered during the handling of customer
support cases.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY
ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits
the distribution URL in the following section is an uncontrolled copy,
and may lack important information or contain factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20090819-fwsm.shtml
In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2009-August-19 | Initial public release |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2008-2009 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
Updated: Aug 19, 2009 Document ID: 110460
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkqMMFYACgkQ86n/Gc8U/uA2jACeLVA38jWbQv4AGpSCvOPVJjgR
NqUAniMoiEUkV/JIDlo1xA0ztaO6jCFR
=2Tm1
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://www.auscert.org.au/1967
iD8DBQFKjJGjNVH5XJJInbgRAl5QAJoCqAxLTsYvO8qHg9J4mnP5NYtz5QCfXAN0
Ak7oSz9ZD8/HCGdDkqI1NhA=
=LGSw
-----END PGP SIGNATURE-----